Connect with us

Financial

LATEST CYBERSECURITY CHALLENGES IN THE WORLD OF BFSI

Published

6 months ago

on

Exclusive interview with Premchand Kurup, CEO, Paramount

Which emerging cyber risks are most likely to influence or reshape GCC banking regulations in the coming years?

We live in an era where nearly every banking service depends on advanced digital infrastructure, and cybercriminals are aware of it. With the emergence of AI, the risks have evolved even further, enabling attacks that can adapt and operate at an unprecedented scale. Over the period of 2024–2026, GCC banking regulations in the region are being influenced by the convergence of advanced ransomware, API-driven open banking risks and AI-enabled cyber threats.

Firstly, targeted ransomware and data extortion attacks against banks and fintechs in the Gulf region have evolved from isolated incidents into a persistent and systemic risk. Financial institutions in the UAE and across the GCC region have experienced a noticeable rise in incidents and malware activity through 2024 and into 2025 by nearly 100%, and this is specific to Paramount. . In response, regulators are tightening requirements for incident reporting timelines, operational resilience testing and recovery capabilities within central banks and national cybersecurity frameworks, with these requirements expected to become more stringent in 2026.

Secondly, the rapid expansion of open banking and digital transformation initiatives has made API security and cloud exposure critical regulatory concerns. Misconfigured cloud environments, weak API authentication, and complex third-party integrations are creating new attack surfaces that traditional perimeter-based security models cannot adequately protect. As a result, regulators in the UAE, Saudi Arabia, and other GCC countries are strengthening supervisory expectations around identity management, data protection and third-party risk management within banking regulations.

Additionally, the rise of AI-driven fraud and AI-assisted cyberattacks is reshaping how supervisors view the intersection of model risks and cyber risks. AI is being increasingly used to support credit assessment, KYC and fraud detection, while also being leveraged by attackers to scale phishing, social engineering and evasion techniques. This dual-use nature of AI is prompting regulators to develop guidance on AI governance, explainability and enhanced monitoring of AI-enabled processes in the financial sector.

What is one underrated cybersecurity innovation today that you believe will become critical for the Middle East’s BFSI sector over the next few years?

One of the most underrated cybersecurity innovations today, and yet one that is likely to become critical for the Middle East’s banking, financial services and insurance (BFSI) sector over the next few years, is behaviour-based analytics, which has become deeply integrated into security operations centre (SOC) functions and fraud detection systems. Numerous financial institutions still rely heavily on static, rule-based systems that trigger alerts based on fixed thresholds or known attack signatures. While effective against traditional threats, these approaches struggle to detect modern attacks that rely on lateral movement, living off the land (LOTL) techniques and sophisticated social engineering.

In contrast, behaviour-driven analytics establishs dynamic baselines for users, devices, applications and APIs. It continuously monitors the way accounts are accessed, transactions are executed and systems communicate, enabling early detection of anomalies that signal potential fraud or intrusion. These capabilities closely mirror the patterns observed in recent high-impact attacks on banks and fintechs across the region. For GCC banks navigating rapid cloud adoption, open banking frameworks and increasing use of AI in core operations, behavioural analytics is becoming essential. It allows institutions to distinguish legitimate high-volume digital activity from subtle intrusions, as highlighted in the report titled ‘2025 Global Digital Trust Insights – Middle East findings’.

Reflecting this shift, Paramount’s advisory and SOC services in the region are increasingly promoting a transition from purely rule-driven monitoring to a blended model that combines behavioural analytics, traditional rules, and threat intelligence. This integrated approach significantly improves detection speed and reduces false positives in complex Middle Eastern financial environments.

From the Paramount SOC’s perspective, approximately how many security incidents or threats have been monitored and mitigated this year


Over the last year we have issued over 592 critical advisories and mitigated them. Critical advisories are those that have the potential to halt business operations significantly.
The year 2026 has just begun, and we have issued nearly 100 advisories already.

Apart from critical advisories we have issued regular 318 advisories this year while the number stood at 2208 last year . We have just begun the year, but the number of alerts shows an increasing trend.

What types of cyber threats are most frequently detected and addressed by the SOC?

During the fiscal year 2024–2025, the most frequently detected threats identified by Paramount’s SOC include phishing and credential theft leading to account takeover, often using highly localised and AI-generated lures. SOC teams also regularly respond to ransomware and data extortion campaigns, alongside API, web application, and DDoS attacks targeting digital banking platforms. Moreover, cloud misconfigurations and excessive access permissions remain a persistent risk, frequently identified through continuous monitoring and threat hunting.

How can C-suite leaders better prepare their organisations, and what proactive steps should banks take to stay ahead of fraud and cyber threats?

For banks across the GCC region, C-suite leaders need to treat cyber resilience as a core board-level business capability, and not simply as a technical or IT function. With cyber threats having direct implications for financial stability, reputation, and regulatory compliance, leadership should embed cyber risk into enterprise risk management frameworks and board reporting. Major threat scenarios such as prolonged digital channel outages, data extortion incidents, or systemic third-party failures should be quantified and reviewed alongside credit and liquidity risks, in line with evolving GCC regulatory expectations. Leaders should further align their cyber strategies with national cybersecurity frameworks and central bank guidance, using independent maturity assessments to identify gaps and prioritise investments through 2026.

From an operational and technology perspective, adopting a zero-trust approach across identities, devices, networks and applications is becoming essential, particularly in API-enabled and cloud-based banking environments. This should be supported by strong SOC and incident response capabilities, whether in-house or through specialised providers such as Paramount, to ensure 24/7 monitoring, rapid containment and documented playbooks for both regulators and customers. Banks also need to invest in advanced fraud analytics and behaviour-based monitoring to detect account takeover and payment fraud, particularly as AI tools make phishing and social engineering more convincing, as witnessed in recent UAE ransomware trends.

Equally important is rigorous third-party and supply chain risk management. This includes structured security due diligence and continuous monitoring of fintech partners, cloud providers and critical vendors, given the growing risk of indirect compromised paths into Gulf financial institutions. Finally, C-suite leaders should actively promote a strong cyber resilience culture. This involves running realistic simulations of ransomware, data leaks, and payment fraud scenarios to sharpen organisational readiness and showcase proactive resilience to regulators, customers and shareholders.

Given the distinct regulatory, cultural, and operational landscape of the GCC, what makes cybersecurity in the region’s BFSI sector uniquely challenging compared to the US or Europe?

Cybersecurity in the GCC region’s BFSI sector is uniquely challenging because financial institutions operate at the intersection of rapid digital transformation, high geopolitical relevance and complex, multi-layered regulation. From a regulatory standpoint, institutions in the region must comply simultaneously with national cybersecurity authorities, central banks, and in some cases, free zone regulators. These entities impose detailed requirements on controls, data protection and incident reporting, creating a more fragmented and demanding compliance landscape than in many single-jurisdiction markets. The situation is further complicated by strict data residency and data sovereignty rules, which significantly influence how banks can design and deploy cloud, analytics, and cross-border platforms.

Operationally, GCC banks are advancing quickly into digital, mobile and open banking services, often faster than ecosystem-wide security maturity. While this supports financial inclusion, it also expands the attack surface through APIs, cloud services, and fintech partnerships. At the same time, the Gulf region has become one of the most actively targeted regions for financially motivated cybercrime and disruptive attacks, with banks and fintechs featuring prominently in 2024–2025 reports on ransomware, DDoS campaigns and sophisticated fraud schemes. The combination of rapid innovation, partner security, high attacker interest and evolving regulatory expectations creates a risk profile that is distinct from more established markets in North America and Europe.

In response, Paramount’s work with GCC BFSI clients focuses on developing region-specific security architectures and systems rather than simply importing models from other geographies. This includes designing frameworks aligned with local regulatory obligations, regional threat intelligence and the operational realities of Middle Eastern institutions as they evolve through 2026.

Related Topics:
Continue Reading

Financial

Connecting Industries and Trade: Malakut Business Forum 2026 Brings Together 750+ Delegates and 300+ Companies

Published

13 hours ago

on

November 10, 2026

By

The Malakut Business Forum 2026 is set to bring more than 750 delegates and over 300 companies together at Sky Bubble, Meydan Hotel, Dubai, on 25 November 2026, with C-suite executives and directors accounting for 60 per cent of attendees.

The one-day forum will convene senior leaders from banking, trade, insurance, logistics and industry across five streams: Finance, Risk, Artificial Intelligence, Logistics and Technology.

The 2026 edition builds on the success of the inaugural forum with even greater scale and a more focused agenda. Organisers are lining up more than 25 industry speakers and over 20 partners, with a projected digital reach of 200,000+ online users, providing even more opportunities for partners to connect, engage and be seen. The key topics to be explored during this edition include business resilience, geopolitical challenges, innovation and the future of global trade.

“Business leaders are making critical decisions under pressure, across borders and with less certainty than ever. The Malakut Business Forum was created to bring the right people into the same room, so decisions are better informed and conversations turn into real opportunities. Our 2026 edition is bigger, bolder and built for impact, and we are proud to host it in Dubai, a global crossroads of trade,” said Alex Dolgopolov, CEO of Malakut, the Founding Partner of Malakut Business Forum 2026

The programme is built around real cases and candid discussion. Finance sessions will examine how companies protect liquidity under pressure and turn high-risk projects into bankable ones. The Risk stream will address securing political violence and war risk cover during active conflict, and what businesses can do when the insurance market will not take the risk. Artificial Intelligence sessions will look at AI savings that reached the P&L, the move from copilots to agents and what leaders refuse to automate. Logistics will tackle rerouting during conflicts and the question of who pays for resilience, while Technology will cover scaling across fragmented markets and modernising core systems without disrupting daily operations.

Beyond the main stage, delegates can expect a networking reception, a partner showcase, a live podcast studio, VIP hospitality and an evening cocktail and dinner experience. Private Skyboxes overlooking the Meydan race track will offer partners an exclusive setting for high-value meetings with clients, prospects and partners.

Continue Reading

Financial

Stablecoins Can Move Money Faster. Can They Make Cross-Border Payments More Reliable?

Published

1 day ago

on

November 9, 2026

By



Imagine a business that pays an overseas supplier in stablecoins. The transfer is confirmed within minutes, but the supplier cannot access the funds in the currency needed to fulfil the order. A bank review holds up the conversion, the delivery date approaches, and neither party knows how long the delay will last.
The payment has worked as a blockchain transaction. As a business transaction, however, it has fallen short.

Jack Tang, Co-founder & CEO


This distinction matters as stablecoins gain attention as a more efficient way to move money internationally. They offer genuine advantages, including faster settlement and the potential to reduce transfer costs. But businesses do not adopt payment methods simply because the technology works. They need to know that money will arrive when expected, that recipients can use it, and that problems can be resolved without leaving both parties in limbo.


For stablecoins to become a practical part of global commerce, the industry must address the parts of a payment journey that technology alone cannot fix.

The Real Cost Is More Than the Transfer Fee


Sending money across borders remains expensive, despite years of investment in digital payments. World Bank data puts the global average cost of remittances at approximately 6.36% per US$100, down from 8.89% in 2010. Progress has been uneven, with established corridors such as the UAE–India and US–Mexico benefiting from more developed financial networks, while some routes serving Africa, Latin America and Southeast Asia continue to face higher costs.


The UAE illustrates why this matters. With expatriates accounting for around 88% of its population, the country is a major centre for international remittances, particularly to South Asia. Improvements in payment infrastructure have implications not only for individuals sending money home but also for companies paying suppliers, contractors and employees abroad.


Stablecoins could help reduce some of the friction involved. Yet headline transaction volumes can obscure how much progress has actually been made in everyday payments. The $8.82 trillion in stablecoin transaction volume cited for the first half of 2026 includes activity that is not necessarily linked to purchasing goods, paying suppliers or settling commercial invoices. Estimates of real-world stablecoin payment activity, at approximately $390 billion, offer a different perspective on adoption.


The distinction is important. Moving a digital asset between wallets is not the same as completing a payment that meets a business’s commercial needs. The latter requires the entire process, from funding and settlement to conversion, reconciliation and confirmation, to work reliably.


Businesses Need Someone to Turn to When Payments Fail


Conventional payment systems have plenty of shortcomings, but businesses generally operate within established arrangements for investigating failed transfers, handling refunds and determining who is responsible for a loss. Stablecoin payments introduce a different set of participants and processes, and responsibility can become less clear when something goes wrong.


A cross-border transaction might involve a stablecoin issuer, a payment provider, an exchange and one or more banks. Each may have its own compliance obligations, operating procedures and timelines. A transaction can settle on-chain while remaining inaccessible to its intended recipient because a bank review, liquidity issue or other operational problem interrupts the next stage.


For a business, the consequences are tangible. A supplier may delay an order, a shipment may miss its window, or a contractual payment deadline may be breached. The savings achieved through faster settlement can quickly lose their value if the business cannot predict when the recipient will actually receive usable funds.


This is why dispute handling, refunds, transaction restrictions and clear escalation procedures need to be considered from the outset. A system designed for commercial use cannot rely on the assumption that every transaction will proceed as intended.


There is room for infrastructure that brings together blockchain-based payments and familiar financial risk controls. Such systems could help coordinate transaction monitoring, counterparty checks and the handling of disputed or interrupted payments.

The objective is not to recreate every layer of traditional banking, but to give businesses a clear process and an accountable party when a payment requires intervention.


International Payments Need International Coordination


The same issue arises at the regulatory level. A business making payments across several markets should not have to navigate a completely different set of operational expectations at every border.


Europe’s Markets in Crypto-Assets Regulation (MiCA), the US GENIUS Act, and frameworks developed by the UAE’s Virtual Assets Regulatory Authority (VARA) and Central Bank of the UAE (CBUAE) represent important efforts to establish rules for digital assets. However, they differ in their treatment of issuers, reserves, disclosures and permitted activities. Approval in one jurisdiction does not automatically establish acceptance in another.


Information-sharing requirements create another challenge. Where Travel Rule protocols are implemented differently, payment providers may struggle to exchange information about transaction participants consistently. This can introduce friction even when the underlying transfer is technically straightforward.
The answer is not necessarily a single global rulebook.

Countries have different legal systems and regulatory priorities. What the industry needs is greater compatibility between those systems: clearer expectations for cross-border transactions, more consistent information-sharing arrangements and practical ways for compliant providers to operate across jurisdictions.


For businesses, regulatory predictability is part of payment reliability. Companies need to understand the conditions under which funds can be transferred, held or released before committing to a payment method.


The Banking Relationship Still Matters


Stablecoins may change how value moves, but they do not eliminate the need to connect digital assets with conventional money. Businesses still need access to fiat currencies, dependable liquidity and banking services that support their operations.
That connection remains a weakness in parts of the market.

Liquidity can be spread across different issuers and blockchain networks, while some banks have chosen to reduce their exposure to digital asset companies rather than develop services for them.


The broader lesson is that blockchain infrastructure cannot operate in isolation. Its commercial usefulness depends partly on the strength of the institutions and services that connect it to the wider financial system.


Reliability Is What Will Make the Difference


None of this means that compliance controls should be weakened. Stablecoin issuers and payment providers must be able to respond to sanctions requirements, suspicious activity and other legitimate reasons to restrict transactions. But businesses also need transparency about why a payment has been held, what steps are required to resolve the issue and who is responsible for communicating the outcome.


Smart contracts can automate agreed payment conditions, but they cannot independently settle every legal dispute or reconcile conflicting requirements across jurisdictions. Those responsibilities must be addressed through contracts, institutions and operating procedures designed around the realities of cross-border commerce.


The next stage of stablecoin adoption will depend on how well the industry deals with these less visible parts of the payment experience. Better settlement technology is valuable, but it must be matched by dependable banking access, compatible regulatory arrangements and clear responsibility when transactions do not go to plan.


For businesses, the question is not simply whether stablecoins can move money faster. It is whether they can make international payments more predictable, easier to manage and less costly in practice.


That is the standard the industry must meet if stablecoins are to become more than an alternative way to transfer digital value.

(Author Info: Jack Tang is an accomplished fintech entrepreneur, at the intersection of payments infrastructure and digital assets. As Co-founder & CEO of London-based BoomFi, Jack leads the platform’s work in crypto payment infrastructure. He has over ten years of experience in entrepreneurship, building and scaling businesses across consumer and enterprise markets.)
Continue Reading

Financial

Pay10 Announces Strategic Partnerships at Dubai FinTech Summit 2026, Advancing the UAE’s Digital Payments Ecosystem 

Published

1 week ago

on

November 3, 2026

By

Pay10, a UAE-regulated financial technology company, today announced a series of strategic partnerships, commercial agreements and Memoranda of Understanding (MoUs) at Dubai FinTech Summit 2026. The announcements mark a step towards expanding digital payment choices and supporting the UAE’s transition towards real-time, interoperable and account-based payments, in alignment with the Central Bank of the UAE’s Financial Infrastructure Transformation (FIT) Programme. 

Pay10’s partnerships with leading brands, including GEMS, Jumbo Electronics, Bikanervala, Allday, Just Gold and Save In Gold, span education, retail, food and beverage and specialised commerce. With live deployments already in place at GEMS, Bikanervala, Allday and Just Gold, Pay10 is extending its payment ecosystem across everyday consumer and business transactions. 

Building a Connected Payments Ecosystem 

Pay10 brings together instant payments, Open Finance, digital accounts, domestic card infrastructure and merchant payment acceptance through an integrated platform. 

Directly integrated with Aani, Pay10 enables instant payments and supports account-based payment experiences. Its Open Finance capabilities allow consumers to securely connect supported bank accounts, access consolidated financial information and monitor spending through one application. Its Jaywan issuance capabilities also enable eligible wallet customers to access domestic card payments across POS terminals, ATMs and e-commerce channels. 

For merchants, the platform offers multiple payment acceptance options, including Pay by Pay10, Pay by Bank, card acceptance, interoperable QR payments, payment links and digital payouts. Its proprietary POS application, QR and soundbox solutions are supported by an in-house Terminal Management System. 

Through supported account-based payment methods, merchants can access funds in real time, helping improve cash flow and reduce payment acceptance costs, with potential savings of up to 70% in applicable use cases. Pay10 also reports transaction success rates of over 90% across its integrated technology infrastructure. 

Strategic Partnerships and Collaborations 

The partnerships with GEMS and Jumbo Electronics aim to expand digital payment choices and improve collection efficiency across education and consumer retail. Existing deployments with GEMS, Bikanervala, Allday and Just Gold demonstrate the application of Pay10’s payment solutions across different commercial environments. 

Allday, a leading convenience chain in the region, presents an opportunity to explore the impact of digital payment solutions across high-frequency, small-value transactions. 

Pay10 also announced several MoUs to explore emerging financial use cases. Its partnership with Yalla Financial Solutions, part of Fintra Holding, will explore bank-account-based wallet funding through Open Finance. 

Additionally, our collaboration with TotalPay will enable TotalPay to access Pay10’s merchant payment acceptance capabilities through its technology platform and integrations. The partnership aims to expand merchant payment choices and simplify the adoption of emerging payment solutions. 

Dr. Waleed Sadek, Founder & CEO of Yalla Financial Solutions, said: “We are pleased to explore this strategic collaboration with Pay10, reflecting our shared vision of building a more connected and accessible financial ecosystem. Through Open Finance and account-based wallet funding, we aim to unlock new opportunities for seamless digital payments and enhance the financial experience for businesses and consumers across the region.” 

Supporting the UAE’s Financial Infrastructure 

Pay10’s strategy aligns with the Central Bank of the UAE’s FIT Programme through the adoption of domestic payment infrastructure, including Aani, Jaywan and Open Finance. By investing in direct infrastructure connectivity and proprietary technology, the company aims to support greater interoperability, financial inclusion and more efficient payment experiences. 

Harry Gill, Founder & Chairman, Pay10, said: “The UAE has laid the foundations for the future of finance, and our goal is to make it accessible to everyone. Pay10 is building a UAE-based alternative payment ecosystem that brings together domestic payment infrastructure, Open Finance, accounts, cards and merchant solutions. Our partnerships with GEMS, Jumbo Electronics, Bikanervala, Allday and Just Gold reflect growing confidence in this vision. We remain committed to advancing the UAE’s financial ambitions through a connected, interoperable ecosystem built to scale globally.” 

Our collaboration with TotalPay will enable it to access Pay10’s payment acceptance capabilities for merchants through TotalPay’s technology platform and integrations. The partnership aims to expand merchant payment choices and simplify the adoption of emerging payment solutions. 

With further agreements, product launches and integrations in development, Pay10 aims to expand its consumer and merchant capabilities across the UAE and international markets. 

Continue Reading

Trending

Copyright © 2023 | The Integrator